Information security in China: A license to print money

There are more users surfing the internet in China without proper information security protection than there are broadband users in the whole of Australia. And yet the unprotected only amount to four percent of a total user base of well over 200m people.

Such are the vast numbers of internet users and potential users in China that it is no wonder firms have worked hard to unlock the Chinese information security market place. As one of the fastest-expanding economies, and thanks to the countless numbers of infrastructure projects and investments from international companies, China is expected to continue producing high demand for security products.

Absolute figures are difficult to come by and subject to analyst segmentation. However, Gartner research shows China was one of the fastest-growing markets in information security spending; expanding more than 30% in 2008. The information security software sector was worth £98m/US$153m (Gartner), and network security worth £230m/US$360m (Frost & Sullivan). Even with the global economic downturn, the Chinese infosecurity market is still expected to grow by 17% per year until at least 2013 (Gartner).

Land grab

Despite the already burgeoning user base, much of that growth will come from new users and new entrants to the market.

Harry Cheung is managing director for Kaspersky, Asia Pacific. He's been focussing on the Chinese anti-virus market since 2005 and attracting new users to the Kaspersky product family is his primary concern. "We are selling our licences for a longer period, and I can afford to do that. If I was doing that in Australia, there is no chance of selling one licence for two or three years because the renewal market is very important.

"In China, renewals are less important. There are something like 20 million new users a year. Capture maybe 10 or 20% of new users and it's enough", he adds.

From a pure opportunity perspective, Cheung continues, "Even the small cities are bigger than the entire Australian market."

Local partnerships, global thinking

Teaming up with a local company in the early days of Kaspersky's China presence was a requirement by the Chinese authorities, but this adds a realistic perspective to foreign thinking, so should not be thought of as a disadvantage, says Cheung.

Paul McKenzie of law firm Morrison & Foerster, Beijing office, says information security companies typically work with a local software development firm in China. "Foreign security technology needs to be localised and made local before it can be offered for sale in China. You need to work on it to change its character from an imported product to a local product", he says.

From a government perspective, this is not just about remaining in control of encryption and information security products, but it's also protecting local jobs and growing the skill's base.

"There is a significant body of legislation governing the establishment of subsidiaries of foreign companies. Chinese foreign investment law is still fairly restrictive. Chinese labour legislation is protective of employees and has been tightened up recently. Companies need to understand the rules applicable to the engagement and termination of employees. There is a long list of things that work differently."

Labour laws are not necessarily an example of restrictive practices, stresses McKenzie. "If you look at labour rules in the EU they can be restrictive too, for example in France. Rules work differently in China than they do in the UK, but if you were to sit down with a French lawyer there would be recognition of similarities."

World class education

China's impressive growth of computer-use is driven by a population well versed in science and technology. Partnering with local firms is a smart way of tapping into that expertise.

Fortinet's country manager for China, Haifeng Gong, says: "The Chinese culture is driven by an understanding that cuts across all classes and cities. Most parents believe education is essential for their children to secure a better future and contribute more to society. This mentality results in a competitive schooling landscape, in which science and mathematics are popular subjects for students.

"The quality of engineering talent is believed to be some of the best in the world. This talent is helping push China to the forefront of new innovative technology", he adds.

The quality of education is reflected in the percentage of Chinese that go online more than aware of the risks. According to a survey of internet users released by the China Internet Network Information Centre (CNNIC), by the end of 2008, over 96% used information security software. Around 70.5% had installed both anti-virus and firewall software, while 28% had used online anti-virus services.

Wireless is King

Furthermore, many new users to China's internet services are bypassing the Western model of cable or ADSL and going straight for a mobile solution delivered wirelessly.

"How people use the internet and how they view it is somewhat different to how we see it in Europe", explains Anthony Walsh, director of enterprise risk services at Deloitte. "The portal provider, or the digital platform being used, provides a full blown service in terms of social networking, instant messaging and email. The portal model is much more prevalent."

Consumers want ISPs (Internet Service Providers) to provide information security packages as part of a service agreement, "There is no need for private software, consumers purchase by subscription from a number of extremely successful portals, or virtual personal spaces", he says.

Walsh argues this could be seen as a more advanced model than in the UK. "It's not so much a maturity as a convenience scenario. Consumers have gone straight to mobile platforms."

Vendors have to take the structure into consideration for sales and marketing. Kaspersky's Harry Cheung has forged relationships with ISPs, focussing on the point at which consumers connect. "I used local ISPs with hundreds of thousands of users providing email for free, and we put Kaspersky into their systems. Whenever users logged into their email they saw their email had been scanned by Kaspersky."

Strategies that work

It's a sales strategy Gartner's Matthew Cheung sees across the sector, "Chinese customers don't tend to buy anti-virus together with the hardware, and the OEM market for anti-virus programmes is not that large. Vendors go direct to the consumers and align with the telecom operators, and consumers purchase security from the telecom operator or broadband provider."

There is a similar one-vendor preference in the enterprise market. Gartner reports that, "Chinese companies seem to prefer one vendor for most applications", selecting providers of stand-alone, best-of-breed products only when the vendor of choice lacks strength in the required features.

Fighting against such a market structure with its huge user and relentless momentum is likely to be suicide. "Foreign companies that have been successful in China have managed to achieve a balance between adaptation to local practices, with the maintenance of basic standards and approaches that make sense in other jurisdiction as well", explains Walsh.

"The wisdom is in balancing good common sense with sensitivity to how things are done in China."